From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:47974 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751974AbdFLMup (ORCPT ); Mon, 12 Jun 2017 08:50:45 -0400 Subject: Patch "ALSA: timer: Fix race between read and ioctl" has been added to the 4.9-stable tree To: tiwai@suse.de, glider@google.com, gregkh@linuxfoundation.org Cc: , From: Date: Mon, 12 Jun 2017 14:50:36 +0200 Message-ID: <1497271836135135@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ALSA: timer: Fix race between read and ioctl to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: alsa-timer-fix-race-between-read-and-ioctl.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From d11662f4f798b50d8c8743f433842c3e40fe3378 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Fri, 2 Jun 2017 15:03:38 +0200 Subject: ALSA: timer: Fix race between read and ioctl From: Takashi Iwai commit d11662f4f798b50d8c8743f433842c3e40fe3378 upstream. The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl. This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window. Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/timer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1963,6 +1963,7 @@ static ssize_t snd_timer_user_read(struc tu = file->private_data; unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read); + mutex_lock(&tu->ioctl_lock); spin_lock_irq(&tu->qlock); while ((long)count - result >= unit) { while (!tu->qused) { @@ -1978,7 +1979,9 @@ static ssize_t snd_timer_user_read(struc add_wait_queue(&tu->qchange_sleep, &wait); spin_unlock_irq(&tu->qlock); + mutex_unlock(&tu->ioctl_lock); schedule(); + mutex_lock(&tu->ioctl_lock); spin_lock_irq(&tu->qlock); remove_wait_queue(&tu->qchange_sleep, &wait); @@ -1998,7 +2001,6 @@ static ssize_t snd_timer_user_read(struc tu->qused--; spin_unlock_irq(&tu->qlock); - mutex_lock(&tu->ioctl_lock); if (tu->tread) { if (copy_to_user(buffer, &tu->tqueue[qhead], sizeof(struct snd_timer_tread))) @@ -2008,7 +2010,6 @@ static ssize_t snd_timer_user_read(struc sizeof(struct snd_timer_read))) err = -EFAULT; } - mutex_unlock(&tu->ioctl_lock); spin_lock_irq(&tu->qlock); if (err < 0) @@ -2018,6 +2019,7 @@ static ssize_t snd_timer_user_read(struc } _error: spin_unlock_irq(&tu->qlock); + mutex_unlock(&tu->ioctl_lock); return result > 0 ? result : err; } Patches currently in stable-queue which might be from tiwai@suse.de are queue-4.9/alsa-timer-fix-race-between-read-and-ioctl.patch queue-4.9/alsa-timer-fix-missing-queue-indices-reset-at-sndrv_timer_ioctl_select.patch queue-4.9/asoc-fix-use-after-free-at-card-unregistration.patch queue-4.9/ptrace-properly-initialize-ptracer_cred-on-fork.patch